using System.Security.Claims;

namespace ZB.MOM.WW.Auth.AspNetCore;

/// <summary>
/// Canonical claim-type constants used across ZB.MOM.WW authentication. Centralising the
/// strings here keeps claim issuance (LDAP/API-key sign-in) and claim consumption
/// (authorization policies, role checks) in agreement on exactly one spelling per concept.
/// </summary>
/// <remarks>
/// <see cref="Name"/> and <see cref="Role"/> deliberately alias the framework's
/// <see cref="ClaimTypes.Name"/> and <see cref="ClaimTypes.Role"/> URIs so that ASP.NET
/// Core's built-in <see cref="ClaimsPrincipal.Identity"/> name resolution and
/// <c>[Authorize(Roles = ...)]</c> / <see cref="ClaimsPrincipal.IsInRole(string)"/> checks
/// work without bespoke configuration. The remaining claim types are app-specific and use
/// stable, short <c>zb:</c>-prefixed names that will not collide with the framework URIs.
/// </remarks>
public static class ZbClaimTypes
{
    /// <summary>
    /// The principal's name claim. Aliases <see cref="ClaimTypes.Name"/> so the framework
    /// populates <see cref="System.Security.Principal.IIdentity.Name"/> from it.
    /// </summary>
    public const string Name = ClaimTypes.Name;

    /// <summary>
    /// A role claim. Aliases <see cref="ClaimTypes.Role"/> so <c>[Authorize(Roles = ...)]</c>
    /// and <see cref="ClaimsPrincipal.IsInRole(string)"/> resolve against it by default.
    /// </summary>
    public const string Role = ClaimTypes.Role;

    /// <summary>Human-friendly display name (distinct from the login <see cref="Name"/>).</summary>
    public const string DisplayName = "zb:displayname";

    /// <summary>The directory/login username the principal authenticated as.</summary>
    public const string Username = "zb:username";

    /// <summary>The identifier of the scope (site/area) the principal's roles apply within.</summary>
    public const string ScopeId = "zb:scopeid";
}
